CWE-312: Cleartext storage of sensitive information

CVEs per yearBy the year they were published

1. 20151
2. 20161
3. 20175
4. 201820
5. 201964
6. 202077
7. 2021123
8. 202281
9. 2023129
10. 2024108
11. 2025114
12. 2026157

Known exploitedNewest addition to KEV first

• CVE-2023-22894

  Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…

  Product not named

  ExploitedHigh7.2
• CVE-2011-4723

  The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.

  Product not named

  ExploitedMedium5.7

Newest CVEs

• CVE-2026-68933

  Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage

  chartbrew · chartbrew

  High7.5
• CVE-2026-54145

  OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

  tinyhumansai · openhuman

  High8.8
• CVE-2026-123059

  Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

  Eclipse Foundation · Eclipse BaSyx Helm Charts

  High7.5
• CVE-2026-123047

  Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

  Eclipse Foundation · Eclipse BaSyx Helm Charts

  High7.5
• CVE-2026-114551

  MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

  MailEnable · MailEnable

  Medium5.9
• CVE-2026-120733

  Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the…

  Devolutions · Server

  High7.5
• CVE-2026-114217

  Konflux-ci: github token plaintext exposure in ci/cd scripts

  konflux-ci

  High8.6
• CVE-2026-110200

  Langflow OSS is affected by multiple vulnerabilities

  IBM · Langflow OSS

  Medium6.5
• CVE-2026-116691

  MLflow CrewAI autologging records LLM provider API keys in logged trace spans

  mlflow · mlflow

  Medium6.5
• CVE-2026-77054

  Cleartext Storage of Sensitive Information in boneIO

  boneIO · boneIO

  Medium6.9

Vendors it comes up for most

1. IBM58
2. Jenkins project42
3. Dell21
4. Red Hat13
5. Siemens12
6. Splunk12
7. Brocade11
8. Fortinet9
9. Cisco8
10. Apache Software Foundation7